CVE-2026-76963

CVE-2026-76963 is a missing authorization check (CWE-862) in Application Server ABAP of SAP NetWeaver and ABAP Platform. A low-privileged authenticated user with network access to the affected system can trigger the flaw and gain unauthorized access to sensitive system configuration information, including security-relevant settings and internal system details. The impact is limited to confidentiality (CVSS 4.3 medium); integrity and availability are unaffected. Any organization running SAP NetWeaver AS ABAP or ABAP Platform is potentially affected. As of this analysis there is no known public proof-of-concept, it is not in CISA's KEV catalog, and EPSS estimates only a 0.2% chance of exploitation within 30 days.

What to do: Apply the corrective patch released by SAP in its September 2026 Security Patch Day for NetWeaver AS ABAP / ABAP Platform, consulting the SAP advisory for the exact versions covered. Until patched, restrict which low-privileged authenticated users can access the affected Application Server ABAP services and review roles/authorizations for over-provisioning. Check logs for unusual authenticated reads of configuration data by low-privilege users.